Is it possible or on the roadmap to have a pod drive the host's firewall settings? I'm talking here about stock k8s, not GCE.
My particular use case is I have some pods that need to set DSCP markings (MANGLE table) on their outgoing traffic. Right now, my only solution is to modify iptables on every node in the cluster. I can limit by destination port and other settings but if I were running a truly open cluster, I really wouldn't want to do this. IMO, whether or not to apply those markings should really be driven by the POD/RCS/Deployment definition. Kubeproxy already owns so much of iptables manipulation; it could make very specific rules only marking traffic coming out of a particular pod IP and dynamically add/remove these rules when a pod is created/destroyed. -- You received this message because you are subscribed to the Google Groups "Containers at Google" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/google-containers. For more options, visit https://groups.google.com/d/optout.
